#OPENSSL SCLIENT CONNECT HOW TO#

Subject= /CN=notBefore=Mar 18 10:55:00 2017 GMTĬool Tip: You can also decode an SSL certificate file if you have it locally, using the openssl utility from the Linux command-line! Read more → Show the all above information about the SSL certificate, at once: $ echo | openssl s_client -servername -connect :443 2>/dev/null | openssl x509 -noout -issuer -subject -dates Subject= /CN=Check for what dates the SSL certificate is valid: $ echo | openssl s_client -servername -connect :443 2>/dev/null | openssl x509 -noout -dates Issuer= /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3Ĭheck whom the SSL certificate is issued to: $ echo | openssl s_client -servername -connect :443 2>/dev/null | openssl x509 -noout -subject OpenSSL: Check SSL Certificate – Additional Informationīesides of the validity dates, an SSL certificate contains other interesting information.Įach SSL certificate contains the information about who has issued the certificate, whom is it issued to, already mentioned validity dates, SSL certificate’s SHA1 fingerprint and some other data.Īll these data can retrieved from a website’s SSL certificate using the openssl utility from the command-line in Linux.Ĭheck who has issued the SSL certificate: $ echo | openssl s_client -servername -connect :443 2>/dev/null | openssl x509 -noout -issuer Info: Run man s_client to see the all available options.Īs an example, let’s use the openssl to check the SSL certificate expiration date of the website: $ echo | openssl s_client -servername -connect 2>/dev/null | openssl x509 -noout -dates The TLS SNI (Server Name Indication) extension (website). Run the following one-liner from the Linux command-line to check the SSL certificate expiration date, using the openssl: $ echo | openssl s_client -servername NAME -connect HOST: PORT 2>/dev/null | openssl x509 -noout -dates Linux users can easily check an SSL certificate from the Linux command-line, using the openssl utility, that can connect to a remote website over HTTPS, decode an SSL certificate and retrieve the all required data.Ĭool Tip: If your SSL certificate expires soon – you will need to generate a new CSR! In Linux this can be easily done with a simple one-liner! Read more → Check SSL Certificate Expiration Date

#OPENSSL SCLIENT CONNECT HOW TO#

As of OpenSSL 0.9.8 you can choose from smtp, pop3, imap, and ftp as starttls options.From this article you will learn how to connect to a website over HTTPS and check its SSL certificate expiration date from the Linux command-line.īesides of validity dates, i’ll show how to view who has issued an SSL certificate, whom is it issued to, its SHA1 fingerprint and the other useful information. Incidentally, this typically means that the server you’re connecting to is IIS.īut what if you want to connect to something other than a bog standard webserver on port 443? Well, if you need to use starttls that is also available. If the server was configured to potentially accept client certs the returned data would include a list of “acceptable client CAs”.Ĭonnection was made via TLSv1/SSLv3 and the chosen cipher was RC4-MD5. If you’re only looking for the end entity certificate then you can rapidly find it by looking for this section. The server certificate section is a duplicate of level 0 in the chain. Chains can be much longer than 2 certificates in length. Subject and issuer information is provided for each certificate in the presented chain. This particular server (has sent an intermediate certificate as well. s: is the subject line of the certificate and i: contains information about the issuing CA. At level 0 there is the server certificate with some parsed information. The certificate chain consists of two certificates. There’s a lot of data here so I have truncated several sections to increase readability.

SSL handshake has read 2123 bytes and written 300 bytes

Issuer=/C=US/O=SecureTrust Corporation/CN=SecureTrust CA Subject=/C=US/ST=Texas/L=Carrollton/O=Woot Inc/CN=*. (limits liab.)/OU=(c) 1999 Limited/CN= Secure Server Certification Authority I:/C=US/O=SecureTrust Corporation/CN=SecureTrust CAġ s:/C=US/O=SecureTrust Corporation/CN=SecureTrust CA 0 s:/C=US/ST=Texas/L=Carrollton/O=Woot Inc/CN=*.

Openssl sclient connect